---
- ansible.builtin.include_role:
    name: evolix/remount-usr

- name: /usr/share/scripts exists
  ansible.builtin.file:
    dest: /usr/share/scripts
    mode: "0700"
    owner: root
    group: root
    state: directory
  tags:
    - apt

- name: Migration scripts are installed
  ansible.builtin.copy:
    src: "{{ item }}"
    dest: "/usr/share/scripts/{{ item }}"
    force: true
    mode: "0755"
  loop:
    - deb822-migration.py
    - deb822-migration.sh
  tags:
    - apt

- name: Exec migration script
  ansible.builtin.command:
    cmd: /usr/share/scripts/deb822-migration.sh
  ignore_errors: yes
  tags:
    - apt

- name: Is system.sources present?
  ansible.builtin.stat:
    path: /etc/apt/sources.list.d/system.sources
  register: _system_sources

- name: Add signed-by when relevant for bookworm
  ansible.builtin.lineinfile:
    dest: /etc/apt/sources.list.d/system.sources
    line: "Signed-by: /usr/share/keyrings/debian-archive-keyring.gpg"
    insertafter: "Suites: bookworm bookworm-updates"
    state: present
  tags:
    - apt
  when: _system_sources.stat.exists or not ansible_check_mode

- name: Is security.sources present?
  ansible.builtin.stat:
    path: /etc/apt/sources.list.d/security.sources
  register: _security_sources

- name: Add signed-by when relevant for bookworm-security
  ansible.builtin.lineinfile:
    dest: /etc/apt/sources.list.d/security.sources
    line: "Signed-by: /usr/share/keyrings/debian-archive-keyring.gpg"
    insertafter: "Suites: bookworm-security"
    state: present
  tags:
    - apt
  when: _security_sources.stat.exists or not ansible_check_mode